Context

Bulletproof hosting refers to web hosting services that offer a high level of protection against takedowns, legal actions, and abuse complaints. These services are often used to host illegal or malicious content.

By using these services, cybercriminals ensure they will not face legal consequences for their malicious actions.

Spamhaus provides an API with a list of known bulletproof ASNs (Autonomous System Numbers): https://www.spamhaus.org/drop/asndrop.json

Project Goal

Craft queries to hard-block requests from these ASNs for all our customers.

Expected Impact

Analysis of undetected requests that will be classified as bad bot traffic (last 2 days):

Daily projection: We can expect to hard-block more than 5 million additional requests per day across all customers.

Note: One ASN alone represents approximately 55% of these requests.

Workflow

1. Fetch data: Request the Spamhaus JSON file
2. Build queries: Create Lucene queries to hard-block traffic from these ASNs for all customers
3. Monitor & adjust: Handle false positives (see below)

False Positive Management